Analysis
- max time kernel
86s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/04/2026, 17:09
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe
- Size 3.1MB
- Sample260423-vplbbaaz2m
- SHA256 c2aafee761b235cd49967f619d9982943716cfe43a44876e87e8cc16520e6900
- MD5 11f675db4d50e898940efaf995e0eac4
- SHA1 b154ec4ca1c047ba02d25c99dbd5a7e3a108904c
- SHA512 43f3ce101e04468acc72ada07458f47ee43b9483e79487e48ab8d1f9fd845dc854e4a49ea2f11bfbd22f90ca04e60f85f05072857b0a292418b6e14b712d9eb2
- SSDEEP 49152:B7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2IKhODPji0Aj:xK5N55sgjOk9WOoZAjo
- TLSH T1F7E56D12F66487F9D8738075C9E29769EA7238510B30E7CB5289E32C5E33BD19937722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/372-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000800000002407d-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4352-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000229f0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023371-133.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/372-1348-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4352-1350-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001a00000001db5d-1662.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e506-2044.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 4352 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 372 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe 4352 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:372
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4352
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.1MB
- SHA256 c2aafee761b235cd49967f619d9982943716cfe43a44876e87e8cc16520e6900
- MD5 11f675db4d50e898940efaf995e0eac4
- SHA1 b154ec4ca1c047ba02d25c99dbd5a7e3a108904c
- SHA512 43f3ce101e04468acc72ada07458f47ee43b9483e79487e48ab8d1f9fd845dc854e4a49ea2f11bfbd22f90ca04e60f85f05072857b0a292418b6e14b712d9eb2
- SSDEEP 49152:B7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2IKhODPji0Aj:xK5N55sgjOk9WOoZAjo
- TLSH T1F7E56D12F66487F9D8738075C9E29769EA7238510B30E7CB5289E32C5E33BD19937722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
- Size 3.2MB
- SHA256 3da8fc8eb56f77a0c8f9cb89dc83dfde3a14531cc3f202124f0254df82dffc97
- MD5 4a3595286f97d8cfdab43c2f595727ab
- SHA1 0115222fa81fdc0c414fe86bd5df6d19ee9aa997
- SHA512 50bab164696e3e9fc07cad1003152835226d1bbb3f2cdaf3e990c1fbbd841bd3603d371b6cfc21f4e9980b61cafe9c605150d534c537f91d7a05c39f38b9715d
- SSDEEP 49152:B7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2IKhODPji0AjMI:xK5N55sgjOk9WOoZAjogI
- TLSH T1DFF55C12F66487F9D4738175C9A29765EA3238610B30E7CB5289E32C5E33BD19D37B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.6MB
- SHA256 1b7244246f626c5b3285e6d232f090cc4bbb376be9e88b693b6109d1c6e094b6
- MD5 96698a568d1c8b3a983ceed31b1fc93c
- SHA1 42f933627beaca7c2de18912ca335052b271090c
- SHA512 f7cfe0bdaf2c016b437028fccf938534e3d65fa47cd75eaab619ade3b0d8d9f566d7629fb1335dbc5f170f326de8c1d5e9b65ee77bc4facd6e4c7bdf5c64741c
- SSDEEP 49152:B7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2IKhODPji0AjKPji0Aj:xK5N55sgjOk9WOoZAjo0jo
- TLSH T153066C12F66487F5D473C075C9E2A769EA3238510B30D6CB5289E72C6E33BD29937722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$
- Size 3.2MB
- SHA256 17f2edcf550f4f4a5a64524284983742722ce528b7f2f55a4e67774465133c3b
- MD5 7e32bd4c5cefc8906f41fe336dfdd347
- SHA1 24797e9e163a130e057643161c7e868ad4fcaa82
- SHA512 d3cd52b7e3c2d1a468dd867fe2a7acbceb1830007540fb10632cacc94fe3e17ae66506965113c015e2a2bb5d5f35c7b9e67c7e53ee1195b19df0adbddd8aefe0
- SSDEEP 49152:B7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2IKhODPji0AjX:xK5N55sgjOk9WOoZAjoT
- TLSH T1FDF54A12F66487F9D4768075CAA29265FA3338210B70E6CB52C9E23C5F33AD19977723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 3.3MB
- SHA256 f0d51d75b925457ed7066fc0f2e82293209e396ff9c5b24c2c47619a314d288b
- MD5 0865f5ce9dee42542a8db4038672e495
- SHA1 589aa2520b120642ebf70ef8088e4475e1ddd335
- SHA512 09059209a76271f0810ac5e68620288edcef16ec550ed85fc45401020889616e1ab2e07c849f9f95cd5ac62ca807f9d7e0831491c290b12bfbf9e60cf7a113d1
- SSDEEP 49152:B7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2IKhODPji0AjYi2WH3:xK5N55sgjOk9WOoZAjoMuX
- TLSH T147F56C22F6A487F9D4738075C9E69369EA3238510B30D6CB5289E32D5E33BD19D37722
- MD5 SHA1 SHA512 SSDEEP TLSH